1:32 p.m.
If you have the image, and you know what the data you're looking for
looks like (i.e. it's text you can search for), try just loading the
image in a hex editor and searching for it.
On Mon, Sep 04, 2023 at 09:05:37AM -0400, Alvin Thompson wrote:
> Hi and thanks for the suggestions,
>
> Since this is Podman for Windows which uses a WSL instance, I’m hopeful that not
starting Podman or messing within the WSL instance will preserve the data if necessary.
WSL stores the EXT4 filesystem in a vhdx image which hopefully is isolated from Windows
enough. If I’m wrong about this please let me know.
>
> This is a work computer with rather strict controls so what I can do with it is
limited. I did make a copy of the WSL disk image so that’s something. Unfortunately, I may
have already overwritten the data because in a panic the first thing I did was try to copy
any folder I could find with the name “container”. I was hoping the files would be
unlinked and cleaned up later if space were needed. Perhaps that’s a feature suggestion.
>
> I’ll see if I can grab another Intel computer, install VirtualBox on it, attach a
copy of the image, and boot a recovery DVD with that.
>
> Thanks,
> Alvin
>
>
> > On Sep 4, 2023, at 8:15 AM, Tobias Wendorff
<tobias.wendorff(a)tu-dortmund.de> wrote:
> >
> > 1. Immediately stop using the system: Cease all activities and avoid any further
operations on the affected system. This minimizes the risk of overwriting the data you
want to recover.
> >
> > 2. Turn it off as soon as possible. Maybe unplug the power supply to turn it off
immeditely.
> >
> > 3. Don't boot from the disk again. Remove it if necessaray.
> >
> > 4. Boot into a data-recovery DVD or put it on another system and mount it
read-only.
> >
> > The more you do on the hard drive, the more likely it is that the data will be
overwritten. The data is then virtually unrecoverable. Normally, however, you can recover
deleted data. They were not intentionally overwritten (shredded).
> >
> >
> > Am 04.09.2023 um 12:26 schrieb Alvin Thompson:
> >> Help!
> >> Is there any way to recover files from a deleted container? Long story
short, I found the behavior of `podman network rm -f` unexpected, and it wound up deleting
most of my containers. One in particular had a month of work in it (I was using it as a
development environment), and it turns out only part of it was backed up. I’m desperate!
> >> This is Podman for Windows, so most of the files on the “host” are in the
WSL environment. I can get into that no problem with `wsl -d podman-machine-default`.
> >> As an added wrinkle, my default connection was
`podman-machine-default-root`, but I was was not running Podman rootful. I’m not sure this
is particularly relevant.
> >> grep-ing for strings which are unique to the development environment shows
one hit in Windows, in
%HOME%/.local/containers/podman/machine/wsl/wsldist/podman-machine-default/ext4.vhdx -
which I assume is the file system for the WSL layer itself. I made a copy of it.
> >> A grep within WSL itself doesn’t show so any hits, so it’s possible the
files were deleted as far as WSL is concerned. I tried searching for an EXT4 undelete
tool, but the only one I found (extundelete) is from 10+ years ago and doesn’t appear to
work anymore.
> >> I haven’t stopped WSL (I’m using /tmp as a staging area) or restarted the
computer.
> >> I’m at wit’s end. I really don’t know where to begin or look to recover
these files, which I really, really need. Any recovery suggestions (no matter how tedious)
would be welcome.
> >> I know it’s too late to change now, but man, the behavior of `podman network
remove` is unexpected.
> >> Thanks,
> >> Alvin
> >> _______________________________________________
> >> Podman mailing list -- podman(a)lists.podman.io
> >> To unsubscribe send an email to podman-leave(a)lists.podman.io
> _______________________________________________
> Podman mailing list -- podman(a)lists.podman.io
> To unsubscribe send an email to podman-leave(a)lists.podman.io